1. Technical Field
The present invention relates to a safety control system, in particular, a configuration in which a single controller monitors a plurality of drive circuits.
2. Related Art
In order to establish work safety in production sites, safety control systems are constructed, in which electricity is supplied to a power source, such as a motor, for mechanical equipment in the state where safety is secured. Such a safety control system includes, for example, a relay unit and a controller.
FIG. 9 is a view illustrating an example of a configuration of a typical safety control system. Referring to FIG. 9, a motor 102 serves as a power source and is operated by being supplied with three-phase ACs from an AC power supply 101. This motor 102 is used to, for example, drive various mechanical devices in a factory. A safety control system 151 supplies drive electricity to the motor 102 from the AC power supply 101 or cuts off the drive electricity thereto.
The safety control system 151 includes a safety controller 110, an emergency stop switch 111, and contactors 112 and 113. The emergency stop switch 111 is illustrated in FIG. 9 as an example of an input apparatus connected to the safety controller 110. The input apparatus may also be a light curtain or a door switch. The contactors 112 and 113 are connected to a power-supply line 103 between the AC power supply 101 and the motor 102. The safety controller 110 has a function of monitoring the contactors 112 and 113.
FIG. 10 is a view to concretely explain a configuration for monitoring contactors. Referring to FIGS. 9 and 10, the power-supply line 103 includes lines L1, L2 and L3 corresponding to respective phases of the three-phase ACs. The motor 102 is connected to the power-supply line 103 through an a-contact 112a of the contactor 112, an a-contact 113a of the contactor 113, and a circuit breaker 105.
The safety controller 110 is provided with a FB output terminal 121 and a FB input terminal 122. Note that the term “FB” represents feedback. A b-contact 112b of the contactor 112 and a b-contact 113b of the contactor 113 are connected in series to each other between the FB output terminal 121 and the FB input terminal 122. Note that the emergency stop switch 111 is omitted in FIG. 10, in order to concentrate on describing the configuration of the contactors 112 and 113.
In general, with regard to a switch, such as a relay or a contactor, which opens or closes the contact by feeding a current to the exciting coil, a term “a-contact” refers to a contact that is opened when no current flows through the exciting coil, but is closed when a current flows therethrough. Meanwhile, the term “b-contact” refers to a contact that is closed when no current flows through the exciting coil, but is opened when a current flows therethrough. The above definitions of the “a-contact” and “b-contact” also apply to the following description.
In the configuration illustrated in FIGS. 9 and 10, the a-contacts 112a and 113a of the contactors 112 and 113, respectively, directly operate distribution of a current to a hazard source (corresponding to, for example, the motor 102 of FIG. 11). In FIG. 9, a FB input represents a signal to be inputted to the safety controller 110. This FB input is inputted to the safety controller 110, so that the safety controller 110 can confirm that the a-contacts 112a and 113a of the contactors 112 and 113, respectively, are normally operating without welding failure. If the a-contact of any of the contactors 112 and 113 is welded, the safety controller 110 cannot cut off a current to the motor 102. Accordingly, it is necessary to detect the failure, such as the welding, of the a-contacts 112a and 113a of the contactors 112 and 113, respectively.
When a safety control system, such as that illustrated in FIGS. 9 and 10, is designed, contactors having a mechanical restriction in which the a-contact and the b-contact operate in relation to each other is used for each of the contactors 112 and 113. In a contactor of this type, the b-contact is opened whenever the a-contact is closed, whereas the b-contact is closed whenever the a-contact is opened.
As illustrated in FIG. 10, the b-contacts 112b and 113b of the contactors 112 and 113, respectively, are connected in series to the FB input terminal 122 of the safety controller 110. The safety controller 110 outputs a safety output, which is a signal for permitting the operation of the contactors 112 and 113. The a-contacts 112a and 113a of the contactors 112 and 113, respectively, are closed in response to this safety output.
Before outputting a safety output to the contactors 112 and 113, the safety controller 110 confirms that a feedback loop created by the b-contacts 112b and 113b of the contactors 112 and 113, respectively, has been closed. This operation corresponds to a FB monitor performed by the safety controller 110. If it is confirmed that the feedback loop has not been closed, or has been opened, the safety controller 110 does not turn on the safety output.
Assuming a case where an a-contactor in at least one of the contactors 112 and 113 is welded, a b-contact in the contactor is forcibly opened. This causes the feedback loop to be opened, so that the user can be aware of the failure. The reason why two contactors are provided is, when the welding of an a-contact is detected in one contactor, to cause the a-contact in the other contactor to be opened. It is believed that the possibility is low, in which both a-contacts 112a and 113a of the contactors 112 and 113, respectively, are welded. Therefore, arranging two contactors makes it possible to cut off the current to the motor 102 more reliably.
To give an example, JP 09-212206 A discloses a control device for a control route. This control device controls, for example, a brushless motor or a DC motor.
To give another example, JP 2003-504863 W discloses a method and system for driving a solenoid. On the basis of the difference between a desired current flow in a solenoid and an actual current flow therein, the solenoid driver controls the actual current flow in the solenoid.
FIG. 11 is a view illustrating another example of a configuration of a typical safety control system. Referring to FIGS. 9 and 11, a safety control system 152 includes a safety drive circuit 114, instead of the contactors 112 and 113. This safety drive circuit 114 may be, for example, a motor control apparatus, such as a servo driver, an inverter, or the like. A safety controller 110 monitors the FB of the safety drive circuit 114, similar to the safety control system 151 illustrated in FIG. 9.
FIG. 12 is a view to explain a feedback loop for controlling a contactor. FIG. 13 is a view to explain a feedback loop in a safety drive circuit. Referring to FIGS. 12 and 13, the b-contact of a contactor (which is exemplified by a b-contact 112b in FIG. 12) is connected between a FB output terminal (OUT) 121 and a FB input terminal (IN) 122 in the safety controller 110. Meanwhile, in many similar cases, the output signal from a semiconductor element 116 is used as a feedback monitor outputted from the safety drive circuit 114. The reason why a semiconductor element is used is to prolong the lifetime of the part that is responsible for a signal output function.
The FB output terminal 121 of the safety controller 110 outputs a constant voltage (for example, DC 24 V). To the FB input terminal 122 of the safety controller 110, a voltage is inputted through the b-contact of the contactor or the semiconductor element. If the input voltage is at a high level, the safety controller 110 determines that the feedback loop has been closed. Otherwise, if the input voltage is at a low level, it determines that the feedback loop has been opened.
FIG. 14 is a view to more concretely explain a connection between the safety controller and the safety drive circuit illustrated in FIG. 13. Referring to FIG. 14, the safety controller 110 includes the FB output terminal 121, the FB input terminal 122, a safety output (1) terminal 123, a safety output (2) terminal 124, and a safety input terminal 126. Each of the safety output (1) terminal 123 and the safety output (2) terminal 124 is a terminal that outputs a signal for permitting the operation of the safety drive circuit 114 (referred to as a “safety output”).
The safety drive circuit 114 includes a semiconductor element 116, a voltage input terminal 131, a FB monitor output terminal 132, a safety input (1) terminal 133, and a safety input (2) terminal 134. The semiconductor element 116 is provided between the voltage input terminal 131 and the FB monitor output terminal 132. Each of the safety input (1) terminal 133 and the safety input (2) terminal 134 is a terminal that inputs a safety output to the safety drive circuit 114 from the safety controller 110. A signal to be inputted to either of the safety input (1) terminal 133 and the safety input (2) terminal 134 is referred to as a “safety input”.
The safety output (1) terminal 123 of the safety controller 110 is connected directly to the safety input (1) terminal 133 of the safety drive circuit 114. The safety output (2) terminal 124 of the safety controller 110 is connected directly to the safety input (2) terminal 134 of the safety drive circuit 114. The FB output terminal 121 of the safety controller 110 is connected directly to the voltage input terminal 131 of the safety drive circuit 114. The FB input terminal 122 of the safety controller 110 is connected directly to the FB monitor output terminal 132 of the safety drive circuit 114.
The FB output terminal 121 of the safety controller 110 outputs a signal of a high level. The safety controller 110 detects that a signal having been inputted to the FB input terminal 122 of the safety controller 110 is a signal of a high level. In this case, the safety output (1) terminal 123 and the safety output (2) terminal 124 of the safety controller 110 output respective signals of a high level. The reason why both of the safety output (1) terminal 123 and the safety output (2) terminal 124 in the safety controller 110 output signals of a high level is to increase the reliability of the safety output.
If both safe inputs 1 and 2 having been inputted to the safety drive circuit 114 are at a high level, the safety drive circuit 114 turns off the FB monitor output. Otherwise, if either of the safety inputs 1 and 2 is not at a high level, namely, at least one of them is at a low level, the FB monitor output is turned on.
FIG. 15 is a timing chart to explain the operation of the safety control system illustrated in FIG. 14. Referring to FIGS. 14 and 15, first, in an initial state (a state prior to a time t11), both of the safety outputs 1 and 2 in the safety controller 110 (which will be described collectively as a “safety output 1/2” in FIG. 15) are at a low level. Although not illustrated in figures, because the safety output 1/2 is at the low level, the FB monitor output is in an “ON” state. Thus, the FB monitor output terminal 132 of the safety drive circuit 114 outputs a voltage.
At a time t11, next, the input signal (safety input) that is inputted to the safety input terminal 126 of the safety controller 110 becomes a high level. In response to this, the safety input also becomes a high level.
At a time t12, subsequently, the safety controller 110 detects that a signal inputted to the FB input terminal 122 has been a signal of a high level. With this, at a time t13, the safety output 1/2 of the safety controller 110 becomes a high level. Accordingly, the safety input 1/2 of the safety drive circuit 114 also becomes a high level. Once the safety input 1/2 becomes the high level, the safety drive circuit 114 turns off the semiconductor element 116. As a result, at a time t14, the FB monitor output is turned off.
However, the semiconductor element 116 causes a voltage drop in the feedback loop of the safety drive circuit. In the case where a single safety controller 110 administrates a plurality of safety drive circuits 114, individual semiconductor elements 116 of the safety drive circuits 114 are directly connected in series to the feedback input terminal of the safety controller 110, as illustrated in FIG. 16. This configuration causes the remarkable voltage drop in the feedback loop of the safety controller 110, so that an input voltage at the FB input terminal 122 is greatly reduced.
When an input voltage at the FB input terminal 122 is considerably low, the safety controller 110 may determine that the feedback loop has been opened. In this case, the safety controller 110 does not turn on the safety output. As a result, it may be impossible for the safety controller 110 to permit the operations of the safety drive circuits 114 even when the safety drive circuits 114 can normally operate. In order to prevent such a great voltage drop from arising in the feedback loop, a configuration has been employed so far, in which only a limited number of safety drive circuits 114 are connected to a safety controller 110.
As a solution to the above disadvantage, it is contemplated that the configuration of a safety controller or a safety drive circuit needs to be modified. However, this solution may involve a risk of increasing the number of man-hours devoted to the development along with the design modification. As a result, this leads to an increase in the overall cost. Moreover, it is necessary to confirm and certify that the modified safety controller or safety drive circuit meets target safety specifications. In order to do so, additional cost and time may be required.
As for the above-mentioned patent documents, JP 09-212206 A mentions a voltage drop in a servo driver (see the paragraph “0043” in the specification of JP 09-212206 A), but lacks the description about the above disadvantage. Likewise, JP 2003-504863 W does not describe this disadvantage.
An object of the present invention is to provide a safety control system that is capable of monitoring many more drive circuits by using a single controller without modifying the configurations of the controller and the drive circuits.